You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by lo...@apache.org on 2013/10/08 16:04:05 UTC
svn commit: r1530275 - in /myfaces/tobago/trunk/tobago-core/src/main:
faces-config/faces-config.xml java/org/apache/myfaces/tobago/lifecycle/
java/org/apache/myfaces/tobago/lifecycle/SecretPhaseListener.java
Author: lofwyr
Date: Tue Oct 8 14:04:04 2013
New Revision: 1530275
URL: http://svn.apache.org/r1530275
Log:
TOBAGO-1319: SessionSecret will not be checked in 2.0.0 alpha
Added:
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/lifecycle/
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/lifecycle/SecretPhaseListener.java
Modified:
myfaces/tobago/trunk/tobago-core/src/main/faces-config/faces-config.xml
Modified: myfaces/tobago/trunk/tobago-core/src/main/faces-config/faces-config.xml
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/faces-config/faces-config.xml?rev=1530275&r1=1530274&r2=1530275&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/faces-config/faces-config.xml (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/faces-config/faces-config.xml Tue Oct 8 14:04:04 2013
@@ -29,6 +29,7 @@
<lifecycle>
<phase-listener>org.apache.myfaces.tobago.internal.ajax.AjaxNavigationListener</phase-listener>
+ <phase-listener>org.apache.myfaces.tobago.lifecycle.SecretPhaseListener</phase-listener>
</lifecycle>
<component>
Added: myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/lifecycle/SecretPhaseListener.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/lifecycle/SecretPhaseListener.java?rev=1530275&view=auto
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/lifecycle/SecretPhaseListener.java (added)
+++ myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/lifecycle/SecretPhaseListener.java Tue Oct 8 14:04:04 2013
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.myfaces.tobago.lifecycle;
+
+import org.apache.myfaces.tobago.config.TobagoConfig;
+import org.apache.myfaces.tobago.webapp.Secret;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.faces.context.FacesContext;
+import javax.faces.event.PhaseEvent;
+import javax.faces.event.PhaseId;
+import javax.faces.event.PhaseListener;
+
+public class SecretPhaseListener implements PhaseListener {
+
+ private static final Logger LOG = LoggerFactory.getLogger(SecretPhaseListener.class);
+
+ public void afterPhase(PhaseEvent event) {
+ final FacesContext facesContext = event.getFacesContext();
+ if (facesContext.isPostback()
+ && TobagoConfig.getInstance(facesContext).isCheckSessionSecret()
+ && !Secret.check(facesContext)) {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("Secret is invalid!");
+ }
+ facesContext.renderResponse();
+ }
+ }
+
+ public void beforePhase(PhaseEvent event) {
+ }
+
+ public PhaseId getPhaseId() {
+ return PhaseId.RESTORE_VIEW;
+ }
+}